blob: d44b494cb19b92e759b9deab433ae798486d8344 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
<table class="head">
<tr>
<td class="head-ltitle">REDZONE(9)</td>
<td class="head-vol">Kernel Developer's Manual</td>
<td class="head-rtitle">REDZONE(9)</td>
</tr>
</table>
<div class="manual-text">
<section class="Sh">
<h1 class="Sh" id="NAME"><a class="permalink" href="#NAME">NAME</a></h1>
<p class="Pp"><code class="Nm">RedZone</code> — <span class="Nd">buffer
corruptions detector</span></p>
</section>
<section class="Sh">
<h1 class="Sh" id="SYNOPSIS"><a class="permalink" href="#SYNOPSIS">SYNOPSIS</a></h1>
<p class="Pp"><code class="Cd">options KDB</code>
<br/>
<code class="Cd">options DDB</code>
<br/>
<code class="Cd">options DEBUG_REDZONE</code></p>
</section>
<section class="Sh">
<h1 class="Sh" id="DESCRIPTION"><a class="permalink" href="#DESCRIPTION">DESCRIPTION</a></h1>
<p class="Pp"><code class="Nm">RedZone</code> detects buffer underflow and
buffer overflow bugs at runtime. Currently <code class="Nm">RedZone</code>
only detects buffer corruptions for memory allocated with
<a class="Xr">malloc(9)</a>. When such corruption is detected two backtraces
are printed on the console. The first one shows from where memory was
allocated, the second one shows from where memory was freed. By default the
system will not panic when buffer corruption is detected. This can be
changed by setting the <var class="Va">vm.redzone.panic</var>
<a class="Xr">sysctl(8)</a> variable to 1. The amount of extra memory
allocated for <code class="Nm">RedZone</code>'s needs is stored in the
<var class="Va">vm.redzone.extra_mem</var> <a class="Xr">sysctl(8)</a>
variable.</p>
</section>
<section class="Sh">
<h1 class="Sh" id="EXAMPLE"><a class="permalink" href="#EXAMPLE">EXAMPLE</a></h1>
<p class="Pp">The example below shows the logs from the detection of a buffer
underflow and a buffer overflow.</p>
<div class="Bd Pp Bd-indent Li">
<pre>REDZONE: Buffer underflow detected. 2 bytes corrupted before 0xc8688580 (16 bytes allocated).
Allocation backtrace:
#0 0xc0583e4e at redzone_setup+0x3c
#1 0xc04a23fa at malloc+0x19e
#2 0xcdeb69ca at redzone_modevent+0x60
#3 0xc04a3f3c at module_register_init+0x82
#4 0xc049d96a at linker_file_sysinit+0x8e
#5 0xc049dc7c at linker_load_file+0xed
#6 0xc04a041f at linker_load_module+0xc4
#7 0xc049e883 at kldload+0x116
#8 0xc05d9b3d at syscall+0x325
#9 0xc05c944f at Xint0x80_syscall+0x1f
Free backtrace:
#0 0xc0583f92 at redzone_check+0xd4
#1 0xc04a2422 at free+0x1c
#2 0xcdeb69a6 at redzone_modevent+0x3c
#3 0xc04a438d at module_unload+0x61
#4 0xc049e0b3 at linker_file_unload+0x89
#5 0xc049e979 at kern_kldunload+0x96
#6 0xc049ea00 at kldunloadf+0x2c
#7 0xc05d9b3d at syscall+0x325
#8 0xc05c944f at Xint0x80_syscall+0x1f
REDZONE: Buffer overflow detected. 4 bytes corrupted after 0xc8688590 (16 bytes allocated).
Allocation backtrace:
#0 0xc0583e4e at redzone_setup+0x3c
#1 0xc04a23fa at malloc+0x19e
#2 0xcdeb69ca at redzone_modevent+0x60
#3 0xc04a3f3c at module_register_init+0x82
#4 0xc049d96a at linker_file_sysinit+0x8e
#5 0xc049dc7c at linker_load_file+0xed
#6 0xc04a041f at linker_load_module+0xc4
#7 0xc049e883 at kldload+0x116
#8 0xc05d9b3d at syscall+0x325
#9 0xc05c944f at Xint0x80_syscall+0x1f
Free backtrace:
#0 0xc0584020 at redzone_check+0x162
#1 0xc04a2422 at free+0x1c
#2 0xcdeb69a6 at redzone_modevent+0x3c
#3 0xc04a438d at module_unload+0x61
#4 0xc049e0b3 at linker_file_unload+0x89
#5 0xc049e979 at kern_kldunload+0x96
#6 0xc049ea00 at kldunloadf+0x2c
#7 0xc05d9b3d at syscall+0x325
#8 0xc05c944f at Xint0x80_syscall+0x1f</pre>
</div>
</section>
<section class="Sh">
<h1 class="Sh" id="SEE_ALSO"><a class="permalink" href="#SEE_ALSO">SEE
ALSO</a></h1>
<p class="Pp"><a class="Xr">sysctl(8)</a>, <a class="Xr">malloc(9)</a>,
<a class="Xr">memguard(9)</a></p>
</section>
<section class="Sh">
<h1 class="Sh" id="HISTORY"><a class="permalink" href="#HISTORY">HISTORY</a></h1>
<p class="Pp"><code class="Nm">RedZone</code> first appeared in
<span class="Ux">FreeBSD 7.0</span>.</p>
</section>
<section class="Sh">
<h1 class="Sh" id="AUTHORS"><a class="permalink" href="#AUTHORS">AUTHORS</a></h1>
<p class="Pp"><span class="An">Pawel Jakub Dawidek</span>
<<a class="Mt" href="mailto:pjd@FreeBSD.org">pjd@FreeBSD.org</a>></p>
</section>
<section class="Sh">
<h1 class="Sh" id="BUGS"><a class="permalink" href="#BUGS">BUGS</a></h1>
<p class="Pp">Currently, <code class="Nm">RedZone</code> does not cooperate with
<a class="Xr">memguard(9)</a>. Allocations from a memory type controlled by
<a class="Xr">memguard(9)</a> are simply skipped, so buffer corruptions will
not be detected there.</p>
</section>
</div>
<table class="foot">
<tr>
<td class="foot-date">January 9, 2009</td>
<td class="foot-os">FreeBSD 15.0</td>
</tr>
</table>
|
